Internship
Student login
← SOC & SIEM learning path
SOC & SIEM · Module 4 of 10

Writing detections

Turn attacker behaviours into alerts.

📖 Key ideas

  1. Detections look for suspicious patterns, not just known signatures.
  2. Examples: brute-force logins, impossible travel, new admin account, unusual PowerShell.
  3. Map detections to MITRE ATT&CK techniques.
  4. Sigma is a generic detection rule format.
  5. Test detections and measure false positives.
💡 Real-life example: Writing detections is training a guard dog to bark at the right smells.
Detection ruleLogic that generates an alert
MITRE ATT&CKKnowledge base of attacker techniques
SigmaGeneric SIEM rule format
Impossible travelLogins from far-apart places too quickly